Review stage 02
Operational questionnaire
Ten prompts turn undocumented assumptions into a visible evidence queue.
Eight weighted categories, two context checks
The eight scoring categories total 100 points. Breach-response context and Significant Data Fiduciary relevance are unweighted readiness questions. Evidence exists earns 100% of a category weight, partial earns 50%, and unknown is excluded.
Answer in the private workspaceGovernance & inventory
Can the team retrieve a current inventory naming the data, purpose and accountable owner?
Inventory extract, owner register and purpose map.Notice & choice
Can the team point to a clear, versioned notice and meaningful choice near collection?
Notice version, collection screenshot and choice record.Rights & grievance
Is there an owner and exercised pathway for requests, correction, erasure and grievance?
Runbook, request-log sample and escalation owner.Retention & deletion
Can the team explain deletion triggers, exceptions and backup treatment?
Retention schedule and deletion exercise record.Security & breach readiness
Can the team retrieve safeguards, access reviews, logging and incident-triage evidence?
Access-review record, logging standard and incident playbook.Processors & transfers
Does the processor, sub-processor and transfer record match how data actually moves?
Processor register, agreement reference and transfer map.Children & guardian handling
Where relevant, has the team reviewed child-data and guardian pathways?
Applicability decision and flow test.Assurance & evidence quality
Are controls sampled, tested and versioned rather than described only?
Test sample, version history and open-gap record.Breach response context
Can the team retrieve incident triage and communication ownership?
Tabletop record and communication decision tree.SDF relevance context
If designated, has the organisation recorded whether SDF-specific duties need specialist review?
Designation or applicability note and decision owner.